ramsay | ae20df0f9ea5d37a95482e89654fcf5929942f2c7f75fbd62fe3c1bb375a592f

General

Target
2026-09-22_7798de7e5bf55eb16e05b5e2c2be84a0_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 734KB
Sample260922-yaastaea23
SHA256 ae20df0f9ea5d37a95482e89654fcf5929942f2c7f75fbd62fe3c1bb375a592f
MD5 7798de7e5bf55eb16e05b5e2c2be84a0
SHA1 23eec3a89899fe64b53497b36e1e5e4346d5be06
SHA512 7dfa9e2d27185ce9decaee76da3b1017e0c1c0afa897b08f24f482afac9b1f228354d4b6a75790e75c2e5b150fe2cd19b9f5c4fc171e6bafa8bb44e4d1302ef8
SSDEEP 12288:emhjiddUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx/H:phWdalj3DSudvGM3MXTVhtSQWGtx/H
TLSH
T155F40221B2948032F46351308AB8D7629F3EBE625BA480DB778C45AE2F617D1DF3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-22_7798de7e5bf55eb16e05b5e2c2be84a0_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 734KB
- SHA256 ae20df0f9ea5d37a95482e89654fcf5929942f2c7f75fbd62fe3c1bb375a592f
- MD5 7798de7e5bf55eb16e05b5e2c2be84a0
- SHA1 23eec3a89899fe64b53497b36e1e5e4346d5be06
- SHA512 7dfa9e2d27185ce9decaee76da3b1017e0c1c0afa897b08f24f482afac9b1f228354d4b6a75790e75c2e5b150fe2cd19b9f5c4fc171e6bafa8bb44e4d1302ef8
- SSDEEP 12288:emhjiddUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2Lmx/H:phWdalj3DSudvGM3MXTVhtSQWGtx/H
- TLSH
  T155F40221B2948032F46351308AB8D7629F3EBE625BA480DB778C45AE2F617D1DF3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2